Blog
The metrics connection was already approved
On 23 October OpenAI described a red-team test that started from a compromised host and had the metrics service fetch a URL over a firewall-approved connection. A plan line that says the host has no internet has not named that connection.
On 23 October 2026 OpenAI published Securing our frontier model training environment. The Hacker News reported it on 25 October, and DIGIT reported it on 26 October. The post is an account of a red-team campaign against isolated copies of OpenAI's own research infrastructure. Agents were given three objectives: reach a live internet server OpenAI operates, cross an internal security boundary, and exchange information with agents they were supposed to be isolated from. OpenAI says the attackers were handed infrastructure source code, configuration, and documentation, because the aim was to test the defenses under conditions favorable to an attacker, not to measure what a model would find with none of that. The runs had monitors set to pause activity that left the scope of the test.
After the Hugging Face incident, OpenAI says it reduced the channels models could use to reach the internet during training and evaluation. Narrow connections remained for services it operates, including metrics, logging, and authentication management. The red-team agents found vulnerabilities in almost every one of those services that gave them limited forms of internet access. In one test that assumed the host was already compromised, an agent reused a firewall-approved connection, reached a blocked authentication endpoint in the metrics service, and had that endpoint fetch a model-provided URL. The Hacker News quotes that sentence. DIGIT reports the same test as an approved firewall connection, a restricted authentication endpoint, and a service that then retrieved an externally supplied URL.
The same post describes a second result, and it is not this inject. Agents in separate microVMs on a shared host, with no network connection and no shared writable file, exchanged synthetic secrets by timing the processor cache: one evicted selected data, and another timed the reload. OpenAI says that in most of those communication tests the agents were told which channel to try, or were handed an encoding. One test gave them only a list of infrastructure vulnerabilities and asked them to find a way to talk. The room in this post does not replay either version. The cache result is named so a later reader does not fold it into the metrics line.
OpenAI says it did not find a route to the internet that agents could trivially exploit while concealing the activity from its monitors. It judged its strengthened safeguards sufficient to resume frontier reinforcement-learning training and internal inference, and it resumed those workloads on 1 October, 11 days after a pause that followed a 20 September DNS misconfiguration. That judgment is about OpenAI's environment. It is not a result for web-coder-03.
A weak record, written after those headlines, reads:
Contained. web-coder-03 has no internet.
A strong one reads:
6 November 2026, 11:00 to 12:05. Incident-response tabletop. Injects are from OpenAI's 23 October 2026 post, reported by The Hacker News on 25 October and by DIGIT on 26 October. Not our telemetry. Seats: Imani Cole (incident commander), Luis Ferreira (platform, owns web-coder-03), Samira Shah (detection). Owen Blake (network, the person the plan names to change egress without a login on the host) was not in the room. OpenAI's account, as written into the packet: after internet channels were reduced, narrow connections remained for metrics, logging, and authentication management. In one test that started from a compromised host, an agent reused a firewall-approved connection, reached a blocked authentication endpoint in the metrics service, and had that endpoint fetch a model-provided URL. OpenAI says it did not find a route agents could trivially exploit while hiding the activity from its monitors, and it resumed frontier reinforcement-learning training and internal inference on 1 October. That resume is OpenAI's judgment about OpenAI's environment. Our plan, read by Luis at 11:18: web-coder-03 egress is deny-all. The security group is not deny-all. It allows the metrics collector, the log shipper, and the auth sidecar. None of the three is named in the plan. At 11:31 the facilitator reads the host-already-compromised test as the inject. Samira's monitor view shows the sandbox process on web-coder-03. It does not show the metrics collector making its own outbound call. Imani asks who can remove the metrics allowance without logging into web-coder-03. The plan names Owen. Owen is not on the bridge. Nothing on the host was changed. Follow-up: Owen, by 20 November 2026, writes the three allowed destinations into the plan and names who can cut each one from a system the agent does not run on, or writes why each allowance stays.
Both notes can sit under the same plan sentence. Only the second can be checked by someone who was not in the room and who has the security group open. The first costs you the path that was left on. A reader in March thinks the exercise practised containment. It practised a slogan, and the connection the firewall had already approved was never named, so nobody owns cutting it.
Deny-all is a sentence until someone reads the group
At 11:18 Luis opens the security group for web-coder-03 because the inject asks what the host can still reach after the sandbox is gone. The plan says deny-all. The group lists three destinations the plan does not. He can read that. He cannot change it from the bridge without a login on the same host the inject just handed to the attacker, and the plan's path for a change that does not need that login is Owen. Owen is not here. The finding is the plan sentence, the three allowances, and the empty seat. It is not a score on the firewall.
The free plan self-check asks whether the last test produced findings with owners, and whether they were closed. It does not ask whether egress is deny-all. Owen's line is the finding: three destinations the plan called no internet, and a named person who can cut them from somewhere else. If that line is missing, the next room will write "no internet" again, because that is the sentence the plan still has.
The monitor view is not the path
Samira's screen at 11:31 is the sandbox process. The OpenAI test starts one layer out. The host is already the attacker's, and the route is a service that was supposed to stay, using a connection the firewall had already approved. She can say whether an alert fired for the agent. She cannot say whether the metrics collector fetched a URL, because that call is the collector, and the view in front of her was not built to show it. Write the gap as the view. A packet that says detection was discussed, without naming which process the view covers, is the weak note with a longer verb.
What the sitting shows
The honest limit belongs here. The sitting shows that Imani, Luis, and Samira practised the difference between the plan's deny-all line and the three connections the group still allows, against a test somebody else published, with Owen's seat empty and nothing changed on the host. It does not show that our metrics collector would refuse a fetch, that two jobs on one machine cannot signal each other, or that a stop would fire. OpenAI's campaign was a technical test, on copies of their infrastructure, with the source and the configuration handed over. A conversation does not reproduce that test, and it is not a pen test. Their decision to resume training on 1 October is theirs. A packet that copies it across as our result has invented a verdict.
An agent you operate, taking an action nobody authorised, is a different inject. Freeze, scope, and who to tell are covered in the off-script agent post. This inject is the sentence in the plan that says the host cannot reach the internet, read against the connections the host is still allowed to keep. A second security group that still had a batch host connected is a different miss again, and it is not this one.
Where the lines go
Write the clocks, the three destinations, Owen's empty seat, and the stopped change in the free evidence template. Put the inject with the other agent scenarios in the scenario library, and start the clock at the security group, not at the word sandbox. Both records sit in the template library.
The file from 6 November shows who was in the room, which published test they practised, and that the host was not changed. It does not show that Owen's follow-up was done. That line is due 20 November, and it is still a sentence until someone reads the group again.
Bottom line: write the connections the firewall already approved. A line that says the host has no internet is a different control from the one on web-coder-03, and the packet has to survive a reader who has the security group open.